gh<� ��������}�5fӚN=�pN�Zմ��(�N\�,2+���CW3��� ���D0��3����PI "I�#���P�mr`�e���%���)�*?$� ���o�r��l��P��Y��ȃ��0D!{s��$2!�ߨś���>�2�������+���>������*A���&��8��<K�g��r�F��>q�O��� 4�uC����|���PN;Зrl�m�EV�����&�;=�1��� �e����{�ٰl8����`&��֧z1L�G�^E�[�GŮi�B�LN�9�^ܜ����ҵcÚ���MW��.Tj�X���� 55�RZ\z-�&�2#�ᬟ�c^��%4һ?8���i�<����'/!���jC[R�:1���?C����8'\-rtl�)A�� A�}��tn�|�B#���6�G�^-H+��m���!t�:ϭ.�&�� �������i|�K��7��v �����_�`����\�0�;ω<GT��5��]�vo�`T������ꄨݔ<S�&�'CІ{! K�jz�gʡ�Xr!��[���.&/=��$R������ �������j%�#:$%�R�`��"#e�F����#��r�=GY�3lo�({�F�.v��i���r�{���ss�i�qB�[�[�����шk<����A���h\� ���|T�a�/m���]�>��:�۩,��~���,���@�9�B(����E�I���2���w�߅Uf|��M���<9O� mL��$�m�Eƭ�Њh��x�g0]Y��Z��G��hĻ�X����F����!��.��v< �oE�ĩ;`�&��U�S��{Y�����`��b�Ӷ׃i�4e%��ba�n�A�:��Q�K�����7�+q��>B����d�U��tR�Ѣ QkF��!KX~�!P��K�.����i�b��)N���#'��8��: .��^�����w�$��;�֏gB�x�]��R���J|�75�����[d��#�������ˉ���������a�2q_���="��|�� 9�2����1��'�;��\�+3��U������[#Yy�^�&\�]�A�w�q����p��B_���/���s�X�{8��?�Z 9"���?.y�!;yJv��X�}�O�c�[�^-���>����QO9���qH�ߺ\�f)*cX<��*Ķ3 ��Gl�(�/^�,h�`�X�&.�sh�VgE��K�,���?�������B:,4��;�����5-�����R-�{G��d`���f����ܦSo��W�Kl���z&�; b��+x��}�L{"�^�N_�T�M�*��3L����"h+���� r���%���03����g�x���(jw=��e�l�������pc#�Yk﵅z��EF�)+vO��A�4eIly��è�H��:�lx� 07 �K��(ڎ!3qc�z�?��E��#Pt��u��r-{$5O�;@�l�~�ԦVH�[}������KyA2�ݬ ��[�g��6N���o���d���㏞m�\kH� &���f ��פ(���N�� u�BY=�D�c��ib�[� R˖���ev�@.� ��~�Y�*�L�bw7�89��_���;��Ϙy������ĥ ���$�ݎ����;n���Ͷ�EM>����r��5��l��� �����}��_~����}Rs���0�|�䵚�6�ea@�������R��K_���A�"�����v�x��7���+��~�=r��5�x'4-�+���Nq��E#~l��6�ۣ�߾�>j�q�)�fH�u��1�u�NI/6�� ��k��'_���no�4>��*=��"Ͳ;LI[�*>��+m�/�X�W����ģ4%FX�9��=�&k��b���Pf%��XM^f���`O�&-}��ԧ�cڍ\�"�ג2�K\�n��mM�lW*��$ �O��]U%����\Y n?�F���jj>�hs6-�Z-=HvfQ��.�;W��W/��H�4}�:Φ=� �ݘmz�Ľ�/.z�gw8}�]A�k�Yz�#q:��OnB aCu'g "�5G������?4ͺC!&�;��(�5�;@z]Q�-�;� � Jp$�~]�����{��C���&F-���:��V!��A�� �$� � wP?���UW@��ï5!&�~��]�Tnꝴ�JдH)W��$��{�$1�������.�w�`7�Ŕ�����4��֬J�J�J�!�H���c;�ƃ}�9o�z����9_G,����8�n��16�ᥩ�bbOZ$>��.y���B�h��k&�t�\�,|�B���I����ʯ<�������&��߳�K�����=���+p����1 MN��fA�º9���A�Th�A�y�!���~���V��Rȃ#�Vc'�9a �[N�X�U~��!��!B8��%k�St�Juk��3iN�`���IR�a�I�~�M�����h�G��E5�骋*���wS<PQ�� �HPR� �ܙ|��*a ��ߧ�����K����*�W@�3s|k�L9���I�|)���cr]�����w/r6v3'�6��M�w��BZ�G"�� p�k�]} ����QKߏ���B/���j��U(��G&�]��-2 ��_�W��U��X���ۺW�\��� ��*0#O~�Z�YbY��o���;r �h�2�A�l�c����2�_L�}�M�7���з�*���n�P���Wۿ%)N��/�ǧpW�G(G��Њ��� 7r�Կ�Mg.G�hY�m;-��{0����l��J�ޙ�.@'��/.�����.��8��o���u�"o%[����H���\�!�3QK(��d��'�4щ��)DvY;�-bI@5��JT���^7�J���|��ua\Ľ��w���2)|�{����߲��篕8I��@9{>����?�4Ms�2�H��~ǽG �=��,8����\����K������N�k4��z�����4��)e������&҇:WXz:��h"���*�������0V���t��k����-�.�
Behavioral task
behavioral1
Sample
6544219597ea80d677fdfd274ae541c8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6544219597ea80d677fdfd274ae541c8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6544219597ea80d677fdfd274ae541c8_JaffaCakes118
-
Size
513KB
-
MD5
6544219597ea80d677fdfd274ae541c8
-
SHA1
63fb3f549bfa9cf8c9dfdb172f539a57ff7e36a2
-
SHA256
7dd40be8de243551fa9fb6feb79554fa2e64940a551a9a4bc62374aa44d43080
-
SHA512
7af4d46b9cf4b08c87549ac2193fc00fb014fec770287273bbe99c680944e6a101b20976f2ef6ade679c4c8f4f230809e69ef259d56dc1ce519a59e480c4c078
-
SSDEEP
12288:5ZnQN/iWHgBvKoIK3MjcTAJRrLKi6khjqIIH9AXCQ6/Sj8i6d/pE0CV:vnm/paKomCAJxKi/gIISRZ8HFo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6544219597ea80d677fdfd274ae541c8_JaffaCakes118
Files
-
6544219597ea80d677fdfd274ae541c8_JaffaCakes118.exe windows:4 windows x86 arch:x86
b0c12f94af6fbc51e1587e9da96be599
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
RaiseException
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegQueryValueExA
Exports
Exports
Sections
CODE Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 864B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 842KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 506KB - Virtual size: 506KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ